Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
31/05/2026, 06:33
General
- Target 2026-05-31_8bb928be539803ade12bfd7d9c4d2dc4_amadey_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
- Size 10.6MB
- Sample260531-ha7jsacy2n
- SHA256 62b1215af3441f59cf6c58b7e08cac864c1ccdc1021f85790ed6506048704b23
Score
9/10
Malware Config
Signatures
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-31_8bb928be539803ade12bfd7d9c4d2dc4_amadey_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-31_8bb928be539803ade12bfd7d9c4d2dc4_amadey_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2484-0-0x0000000000ED0000-0x0000000001976000-memory.dmp
memory/2484-1-0x0000000006460000-0x00000000064FC000-memory.dmp
memory/2484-2-0x0000000006AB0000-0x0000000007056000-memory.dmp
memory/2484-3-0x0000000006500000-0x0000000006592000-memory.dmp
memory/2484-4-0x00000000066C0000-0x00000000066D0000-memory.dmp
memory/2484-5-0x0000000006430000-0x000000000643A000-memory.dmp
memory/2484-6-0x0000000006730000-0x0000000006786000-memory.dmp